Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Handle IPv6 addresses in full_uri (add brackets) #9285

Merged
merged 1 commit into from
Dec 7, 2017

Conversation

wvu
Copy link
Contributor

@wvu wvu commented Dec 7, 2017

We're not ready for IPv6.

[12/07/2017 18:48:05] [e(0)] core: Error running against host [redacted]: bad URI(is not URI?): http://[redacted]/
/opt/metasploit-framework/embedded/lib/ruby/2.4.0/uri/rfc3986_parser.rb:67:in `split'
/opt/metasploit-framework/embedded/lib/ruby/2.4.0/uri/rfc3986_parser.rb:73:in `parse'
/opt/metasploit-framework/embedded/lib/ruby/2.4.0/uri/common.rb:231:in `parse'
/opt/metasploit-framework/embedded/framework/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb:59:in `potential_static_files_uris'
/opt/metasploit-framework/embedded/framework/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb:78:in `check_host'
/opt/metasploit-framework/embedded/framework/modules/auxiliary/scanner/http/ms15_034_http_sys_memory_dump.rb:164:in `run_host'
/opt/metasploit-framework/embedded/framework/lib/msf/core/auxiliary/scanner.rb:135:in `block (2 levels) in run'
/opt/metasploit-framework/embedded/framework/lib/msf/core/thread_manager.rb:100:in `block in spawn'
  • use auxiliary/scanner/http/ms15_034_http_sys_memory_dump
  • set rhost to an IPv6 address
  • Ensure a web server is running on the address and port specified
  • Make sure you don't receive a URI::InvalidURIError from missing brackets

Via jabberwock on IRC. Thanks to @acammack-r7.

@acammack-r7 acammack-r7 merged commit 2565ad6 into rapid7:master Dec 7, 2017
acammack-r7 added a commit that referenced this pull request Dec 7, 2017
@acammack-r7
Copy link
Contributor

Release Notes

This adds brackets around IPv6 addresses in generated HTTP URIs. Some modules like auxiliary/scanner/http/ms15_034_http_sys_memory_dump would previously crash or produce invalid URIs as output when run against IPv6 hosts.

@wvu wvu deleted the bug/ipv6 branch December 7, 2017 21:33
@tdoan-r7 tdoan-r7 added the rn-fix release notes fix label Dec 20, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug library rn-fix release notes fix
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants